A ten-person company depends on the same internet connection as a large enterprise, yet its network edge is often guarded by nothing more than the modem the provider left behind. Attackers are well aware of this gap. Automated scanners sweep small-office IP ranges around the clock, hunting for exposed management ports, outdated firmware and unprotected remote-desktop services. A correctly configured firewall and VPN router closes most of those doors in a single afternoon of work, which makes it one of the highest-return infrastructure investments a small organisation can make.

What a small-office firewall actually does

At its core, a firewall decides which traffic may enter or leave the network. Consumer devices handle this with simple network address translation, which hides internal machines but offers little visibility or control. Business-grade gateways add layers of inspection that begin to matter the moment real customer data, invoices and credentials start flowing through the line.

Stateful packet inspection

A stateful firewall tracks every connection from start to finish. When a workstation opens a session to a web server, the firewall records it and only permits replies that belong to that session. Unsolicited inbound packets are dropped by default. This single mechanism blocks the majority of opportunistic scanning traffic without any tuning, and it is the baseline every office gateway should provide out of the box.

Next-generation and UTM features

Unified threat management appliances and next-generation firewalls extend the concept considerably. They identify applications regardless of the port they use, block known malicious domains, inspect downloads for malware signatures and run intrusion prevention rules against live traffic. For a small office, the most valuable additions are usually DNS or web filtering, which stops users from ever reaching phishing infrastructure, and intrusion prevention, which shields unpatched internal systems from known exploits while the update backlog is being worked through.

Datasheet throughput and real-world throughput are different numbers. Enabling intrusion prevention and TLS inspection can cut advertised performance by half or more, so always size the device against the figure measured with security services switched on.

VPN in plain terms: two jobs, one device

A virtual private network encrypts traffic between two points so it can safely cross the public internet. In a small office the router typically performs two distinct VPN roles, and it pays to evaluate both before purchase rather than discovering a limitation later.

Remote-access VPN for the team

Each employee installs a lightweight client on a laptop or phone. Once connected, the device behaves as if it were plugged into the office switch: file shares, printers, the accounting server and internal web tools all become reachable through an encrypted tunnel. Compared with exposing remote desktop or file services directly to the internet, this approach reduces the external attack surface to a single, hardened endpoint that can be monitored and rate-limited.

Site-to-site VPN between locations

When a company operates a second office, a warehouse or a hosted server, a site-to-site tunnel links the two networks permanently. Routing happens automatically, so users never launch a client; the branch simply sees the head-office subnet as a neighbouring network. Two mid-range routers configured with IPsec can maintain such a tunnel for years with minimal attention beyond firmware updates.

Choosing a VPN protocol

  • IPsec with IKEv2 — the industry standard for site-to-site links, supported by every serious router vendor. Hardware acceleration is common, so throughput is high, and native clients exist on Windows, macOS, iOS and Android.
  • OpenVPN — flexible and firewall-friendly because it can run over TCP port 443. Configuration files are easy to distribute to staff, though throughput on smaller routers is often limited by single-core CPU performance.
  • WireGuard — a modern protocol with a very small code base, fast handshakes and excellent performance on modest hardware. Support has spread rapidly across business router firmware, and for new remote-access deployments it is frequently the best starting point.
  • PPTP and plain L2TP — legacy options that should no longer be deployed. PPTP encryption has been broken for years, and unencrypted L2TP offers no confidentiality at all.

Sizing a gateway for 5 to 50 users

Vendors segment their portfolios by firewall throughput, concurrent sessions and VPN capacity. As a practical rule of thumb:

  • Up to 10 users on a connection below 300 Mbps: an entry-level business router with a stateful firewall, 100 to 200 Mbps of IPsec throughput and support for around ten tunnels is sufficient.
  • 10 to 25 users or gigabit connectivity: look for a device rated near gigabit firewall throughput with security services enabled, at least 300 Mbps of VPN capacity and VLAN support across all ports.
  • 25 to 50 users, VoIP telephony and multiple sites: choose a gateway with a multi-core CPU, dual WAN inputs for failover and centralised cloud or controller management if several locations will be administered together.

Concurrent session capacity matters more than raw megabits once many cloud applications are in daily use, because each browser tab and sync agent holds dozens of connections open. Comparing business routers with integrated firewall and VPN support side by side on these three figures usually narrows the field to a handful of realistic candidates.

Segmentation: the quiet security multiplier

Once the edge is protected, the next win is separating internal traffic. Create at least three zones: a staff network for workstations, a guest network that reaches only the internet, and a device network for printers, cameras and smart equipment. If one zone is compromised, the intruder cannot move laterally into the others. Most business gateways implement this with VLANs, and when wireless coverage is delivered by wireless routers or access points that broadcast multiple SSIDs, each SSID can be mapped to its own VLAN with a separate password and firewall policy.

A deployment checklist that prevents the usual mistakes

  • Change every default password, including the one on the modem running in bridge mode.
  • Disable management access from the WAN interface; administer the device only from the internal network or through the VPN itself.
  • Update firmware immediately after installation and schedule a quarterly review.
  • Create individual VPN accounts per employee and revoke them the day someone leaves.
  • Enable logging and forward events to a mailbox or syslog target that someone actually reads.
  • Export and store the configuration file offline after every significant change.
  • Test failover and the VPN from an outside connection before declaring the project finished.

Distributors such as DistriNode stock the full spectrum of networking equipment, from entry gateways to rack-mounted appliances, which makes it straightforward to standardise on one vendor family across several sites and keep spare units on the shelf.

Frequently asked questions

Does a small office need a hardware firewall when every laptop already has a software one?

Yes. Endpoint firewalls protect a single machine and depend on that machine being healthy. A perimeter device filters traffic before it reaches any endpoint, covers printers and IoT devices that run no security software at all, and keeps working even when a laptop is misconfigured or infected.

How much VPN throughput is enough for remote work?

Estimate 5 to 10 Mbps per active remote user for ordinary office work and video calls. Five simultaneous home workers therefore need roughly 50 Mbps of sustained encrypted throughput, and a healthy safety margin means selecting a router rated at least twice that figure.

Is WireGuard mature enough for business deployments?

Its cryptographic design has been independently audited and the protocol is included in the Linux kernel as well as in the firmware of major router brands. For remote-access use it is considered production-ready; site-to-site links between different vendors are still more commonly built on IPsec for compatibility reasons.

Can one appliance replace the router, firewall, switch and Wi-Fi?

In offices of up to roughly ten people, an all-in-one gateway is a reasonable choice. Beyond that size, separating the roles pays off: a dedicated gateway at the edge, a managed switch for the wired network and access points for coverage scale independently and fail independently.

How often should gateway firmware be updated?

Check quarterly at minimum, and immediately whenever the vendor publishes a security advisory affecting VPN or management components. Subscribe to the vendor security mailing list on the day of installation so critical patches are never missed.

What happens to the VPN if the office IP address changes?

Use a dynamic DNS hostname instead of a raw IP address in every client profile and tunnel definition. When the provider assigns a new address, the hostname updates automatically and tunnels re-establish without manual intervention.